LLM-Based Script Analysis for Malicious Action Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional script-based malicious behavior detection methods face challenges in accurately identifying threats due to the use of evasion techniques like packing and obfuscation, leading to time-consuming and environment-dependent dynamic analysis that introduces subjectivity in determining malicious behavior.
Innovation Solution
An electronic apparatus uses a Large Language Model (LLM) to infer static and dynamic analysis results by preprocessing script data to match its input format, training the LLM with static and dynamic analysis results, and predicting analysis outcomes without actual script execution, thereby reducing time and environmental dependencies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If dynamic analysis is performed by actually executing the script, then accurate detection of malicious behavior is achieved, but time consumption increases significantly
Solution Approach 1:
The system performs static analysis and extracts features from the script code before actual execution. By pre-processing the script and identifying suspicious patterns, variables, and execution flows in advance, the system prepares analysis data that can be used for rapid inference without requiring full dynamic execution for every script assessment.
Solution Approach 2:
The system creates a virtual execution environment and generates virtual machine code that simulates the actual script execution. Instead of running the original script directly, the system executes a copied or simulated version that produces equivalent analysis results without the time penalty of full dynamic analysis, allowing rapid inference of malicious behavior patterns.
2Measurement precision
If dynamic analysis is performed by actually executing the script, then complete malicious behavior is observed, but environmental dependencies introduce subjectivity in determination
Solution Approach 1:
The system employs a unified inference model that processes both static analysis results and simulated dynamic analysis results through the same Large Language Model. This multi-functional approach allows the system to achieve consistent determination across different analysis methods and environments, reducing subjectivity by applying the same evaluation criteria regardless of whether the script was actually executed or simulated.
Solution Approach 2:
The system transforms the analysis approach by changing from environment-dependent actual execution to environment-independent inference. By converting dynamic analysis into a simulation-based approach where execution results are predicted rather than directly observed, the system eliminates environmental variables such as network availability, server responses, and timing conditions that previously introduced subjectivity into the determination process.
3Measurement precision
If multiple static and dynamic analysis tools are used for in-depth analysis, then detection accuracy is improved, but time consumption and system complexity increase
Solution Approach 1:
The system merges multiple analysis functions into a unified Large Language Model that performs both static analysis and dynamic analysis inference through a single model architecture. Instead of maintaining separate toolchains for static analysis, dynamic analysis, and result correlation, the system combines these functions into one integrated system that processes script code and produces comprehensive security assessments, thereby reducing system complexity while maintaining detection accuracy.
Data Source
AI summary
An operation method of at least one electronic apparatus is disclosed. The operation method according to the present disclosure comprises acquiring static and dynamic analysis results corresponding to the results obtained by performing static and dynamic analyses performed on a plurality of scripts, each classified as benign or malicious, converting the static and dynamic analysis results of each of the plurality of scripts into text formatted to match the output format of at least one Large Language Model (LLM), training the LLM based on the converted text so that the LLM infers static and dynamic analysis results from an input script, and predicting static and dynamic analysis results for at least one target script based on the trained LLM.